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REMARKS 

Claims 1-22 are pending in the present application. Claim 1 has been amended 
herewith. Reconsideration of the claims is respectfully requested. 

L 35 U.S>C. § 101 

The Examiner rejected Claims 1-22 under 35 U,S.C, § 101 as being directed 
towards non-statutory subject matter. This rejection i$ respectfully traversed. 

With respect to Claims 1 and 12, the Examiner states "In claims 1 and 12 the 
applicant claims a method for creating policy groups, moving a data element between 
groups and generadng a privacy policy based upon a privacy group. This process might 
be performed without the aid of any technology and therefore the claimed method is not 
within the technological arts," 

Applicants respond to the Claim 1 rejection be showing that Claim 1 has been 
amended to specifically recite a data processing apparatus-implemented method, and that 
the recited steps are data processing apparatus-implemented steps. Thus, amended Claim 
1 is shown to expressly recite technology and therefore is directed to "useful arts". 

Applicants respond to the Claim 12 rejection by showing that, and contrary to the 
Examiner's assertion, such claim does not claim a method. Rather, Claim 12 expressly 
recites an apparatus with corresponding "means for" elements, as shown below: 

12. An apparatus for creating a privacy policy, comprising: 
creation means for creating a policy group; 

movement means for moving a data element to the policy group; and 
generadon means for generating a privacy policy based on the policy 

group. 

Per 35 USC 112, 6'^ paragraph, "means for" elements shall be construed to cover the 
corresponding structure or material described in the specification and equivalents thereof. 
Thus, the recited means for elements are shown to not merely describe a process that 
might be performed without the aid of any technology, as alleged by the Examiner, and 
Claim 12 is thus shown to have been erroneously rejected under 35 USC 101. 
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With respect to dependent Claims 2-11 and 13-22, Applicants traverse for reasons 
given above regarding their respective independent claims. 

Therefore, the rejection of Claims 1-22 under 35 U.S.C. § 103 has been 
overcome. 

n. 35 U.S>C. S 103. ObviousTiess 

The Examiner rejected Claims 1-22 under 35 U,S.C. § 103 as being unpatentable 
over Moriconi et al (US Patent 6,158,010) in view of Abraham ei al (WO 98/40987). 
This rejection is respectfully traversed. 

Generally speaking, the present invention is specifically directed to privacy 
policies^ and in particular to methods and apparatus for creating a privacy policy. None 
of the cited references teach or suggest any type of privacy policy, or the creation of a 
privacy policy. To establish prima facie obviousness of a claimed invention, all of the 
claim limitations must be taught or suggested by the prior art. MPEP 2143,03. See also, 
Jn re Royka, 490F.2d 580 (C.C.RA. 1974) (emphasis added by Applicants). 

Specifically with respect to Claim 1, such claim recites a method for creating a 
privacy policy. In contrast, the teachings in the cited Moriconi reference arc directed to 
ensuring that clients are authorized to access securable components (Col. 13, lines 14-32) 
by use of a security policy (Claim 1). Security and privacy are two very different 
concepts, and the teaching of one (security, as taught by Moriconi) does not teach or 
suggest the other (privacy, as claimed). For example, imagine a person living in a 
locked, bullet-proof glass house, where the glass is see-through. This locked, bullet- 
proof glass house is certainly secure, but it is not at all private. As another example, per 
an article by CIO Magazine data November 1, 2001 (accessible on the internet at 
http://www.cio.com/archive/110101/court_stdebar_l.html), it states: 

Security Versus Privacy 

The distinctions can be confusing, but security &nd privacy are indeed 
different issues 
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Without security, there can be no privacy, so the two subjects are 
forever entwined. Legally, however, the issues are quite different. Fred 
H. Cate, professor of law at Indiana University and senior policy 
adviser to the Center for Information Policy Leadership, explains the 
distinction as succinctly as anyone. "I think of privacy as the use of the 
data by somebody you gave it to, and security as the theft of the data 
or the interception of the data by the unknown third party," he says. 
"If I buy a ticket from Travelocity, what Traveloclty does with my data 
is a privacy issue. If somel^ody hacks into Travefocity and steals that 
data, that's a security issue. And we've had a tendency to confuse the 
two." 

Although some cases do involve both security and privacy, two sets of 
legal precedents are likely to emerge. Privacy lawsuits— such as the 
ones well-known Attorney Arthur Miller discusses— involve business 
decisions to use information in a certain way. The security-related 
lawsuits discussed in this article involve situations where information 
security fails, causing an unintended use of information or systems. 
Sarah D. Scalet 



Indeed, even the plain dictionary meaning recognize$ that these two terms mean very 
different tilings. According to The American Heritage Dictionary of the English 
Language, Fourth Edition, Copyright © 2000 by Houghton Mifflin Company* these two 
terms mean: 



5e*cu*ri*ty 

1 . Freedom from ri$k or danger, safety. 

2. Freedom from doubt, anxiety, or fear; confidence. 

3. Something that gives or assures safety 

pri*va-cy 



a. The quality or condition of being secluded from the presence or view of 
others. 

b. The state of being free from unsanctioned intrusion: a person's right to 
privacy. 

2, The state of being concealed; secrecy. 
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It is thus shown that a teaching of using a security policy to limit user access to resources 
(as taught by the cited Mojriconi reference) does not teach or suggest any type of privacy 
policy creation or generation, as claimed. Thus, the Examiner has failed to establish a 
prima facie showing of obviousness with respect to Claim 1, as all the claimed limitations 
are not taught or suggested by the cited references. In addition, as a proper prima facie 
showing of obviousness has not been made, the burden ha$ not shifted to Applicants to 
rebut an obviousness assertion^ It is also shown that because of such failure to establish 
a prima facie showing of obviousness, the rejection under 35 USC 103 is improper . 

Applicants traverse the rejection of Claims 2-22 for reasons given above 
regarding Claim 1. 

Therefore, the rejection of Claims 1-22 under 35 U.S.C. § 103 has been 
overcome. 



* In rejecting claims under 35 U.S.C Section 103. the examiner bears the initial burden of presenting a 
prima facie case of obviousness. In re Oetiker. 977 F.2d 1443, 1445, 24 USPQ2d 1443, 1444 (Fed. Cir. 
1992). Only if that burden is met does the burden of coming forward with evidence or argument shift to 
the applicanL Id. 

^ If the examiner fails to establish a prima facie case, the rejection is improper and will be overturned- In re 
Fine, 837 R2d 1071. 1074, 5 USPQ2d 1596, 1598 (Fed. Cir. 1988). 
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ni. Conclusion 

It is respectfully urged that the subject application is patentable over the cited 
references and is now in condition for allowance. The Examiner is invited to call the 
undersigned at the below-listed telephone number if in the opinion of the examiner such a 
telephone conference would expedite or aid the prosecution and examination of this 
application- 

DATE: ^ G^7/^V 



Respectfully submitted. 




Duke W. Yee 
Reg. No. 34,285 



Wayne P. Bailey 
Reg. No. 34,289 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 367-2001 
Attorneys for Applicants 
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